Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4

Monday 30 January 2017 @ 11.27 a.m. | Trade & Commerce

The Full Federal Court has unanimously overturned an appeal from the Privacy Commissioner against Telstra in a case concerning customer access under the Privacy Act 1988 (Cth) (“the Privacy Act) to “metadata” held by the company.  While the case has a lengthy history, the appeal itself was determined on what Justice Kenny and Justice Edelman described as “a very narrow question of statutory construction concerning the meaning of the words “about an individual” as they applied in the Privacy Act prior to 12 March 2014” [at 5].

Background to the Case

In June 2013, technology journalist Ben Grubb made a request that Telstra provide him with “all the metadata information Telstra has stored about my mobile phone service”.  Telstra initially referred him to its online billing platform, after which Mr Grubb filed a complaint with the Office of the Australian Information Commissioner (“the OAIC”) under s 36(1) of the Privacy Act.  Telstra eventually provided Mr Grubb with various information, including call records, bills, information about his handset, and a document listing all his personal information listed on their customer management system.  However, Telstra disputed whether it had any obligation to provide mobile phone network data (e.g. URL or IP information) or incoming call records.

Procedural History

The Privacy Commissioner made an initial determination and found that Telstra had breached the Privacy Act by failing to provide Mr Grubb with his personal information, as defined in s 6:

“personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.”

Telstra then sought a review of the decision by the Administrative Appeals Tribunal (the “AAT”).  The Deputy President overturned the Privacy Commissioner’s ruling:

“Had Mr Grubb not made the calls or sent the messages he did on his mobile device, Telstra would not have generated certain mobile network data. It generated that data in order to transmit his calls and his messages. Once his call or message was transmitted from the first cell that received it from his mobile device, the data that was generated was directed to delivering the call or message to its intended recipient. That data is no longer about Mr Grubb or the fact that he made a call or sent a message or about the number or address to which he sent it. It is not about the content of the call or the message. The data is all about the way in which Telstra delivers the call or the message. That is not about Mr Grubb. It could be said that the mobile network data relates to the way in which Telstra delivers the service or product for which Mr Grubb pays. That does not make the data information about Mr Grubb. It is information about the service it provides to Mr Grubb but not about him.” [excerpt from original at [43] of the Full Federal Court’s judgment]

Decision of the Full Federal Court

The Privacy Commissioner appealed against the AAT decision to the Full Federal Court, on a number of grounds, none of which were upheld.  In a joint judgment, Justices Kenny and Edelman classified grounds 2, 3 and 4 as raising the “same issue concerning the proper construction of National Privacy Principle 6.1 and whether the AAT applied the right test.”  The Privacy Commissioner argued that the correct test should have been whether the information could have been used to identify Mr Grubb.  However, their Honours rejected this argument [at 63]:

“The words “about an individual” direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters. Further, on the assumption that the information refers to the totality of the information requested, then even if a single piece of information is not “about an individual” it might be about the individual when combined with other information. However, in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual.”

TimeBase is an independent, privately owned Australian legal publisher specialising in the online delivery of accurate, comprehensive and innovative legislation research tools including LawOne and unique Point-in-Time Products.

Sources:

Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 (19 January 2017)

Related Articles: